Uh oh!
There was an error while loading. Please reload this page.
Add 1ES lane for building Copilot CLI with latest MXC - #1116
Draft
Huzaifa Danish (huzaifa-d) wants to merge 2 commits into
Draft
Add 1ES lane for building Copilot CLI with latest MXC#1116Huzaifa Danish (huzaifa-d) wants to merge 2 commits into
Huzaifa Danish (huzaifa-d) wants to merge 2 commits into
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Private-source logging, fail-open manifest sanitization, and unwired contract tests must be addressed.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Balanced
Findings: 2
New issues introduced by this change (3)
| Severity | Finding |
|---|---|
 | .github/workflows/Validation.CopilotCli.Mxc.Job.yml — This directly streams pnpm, Cargo, rustc, and bundler diagnostics from the private checkout into… |
| scripts/ci/CopilotCliMxcBuild.psm1 — Validate the manifest before writing it. This branch suppresses deletion failures and then throws,… |
 | scripts/ci/test-copilot-cli-mxc-build.ps1 — This new contract suite is not invoked by any workflow, so future changes to the helper or… |
What changed in this PR
Adds a manual 1ES lane that builds the latest Copilot CLI against MXC main and records provenance.
Changes:
- Adds reusable and dispatch workflows for the build lane.
- Adds build helpers, orchestration, and contract tests.
- Documents the lane and its security boundaries.
| File | Description |
|---|---|
.github/workflows/Validation.Tests.Scheduled.yml | Adds the manual plan. |
.github/workflows/Validation.CopilotCli.Mxc.Job.yml | Defines checkout, build, evidence, and cleanup. |
scripts/ci/CopilotCliMxcBuild.psm1 | Implements build and provenance helpers. |
scripts/ci/build-copilot-cli-with-mxc.ps1 | Orchestrates compilation and staging. |
scripts/ci/test-copilot-cli-mxc-build.ps1 | Adds contract tests. |
docs/ci-validation-infrastructure.md | Documents the lane. |
.github/copilot-instructions.md | Records the new CI architecture. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+91
to
+95
| ./scripts/ci/build-copilot-cli-with-mxc.ps1 ` | ||
| -MxcRoot "$env:GITHUB_WORKSPACE\source\mxc" ` | ||
| -CliRoot "$env:GITHUB_WORKSPACE\source\cli" ` | ||
| -StageRoot "$env:RUNNER_TEMP\copilot-mxc-test" ` | ||
| -ManifestPath "$env:RUNNER_TEMP\copilot-cli-mxc-provenance.json" |
Comment on lines
+378
to
+398
| $json = $manifest | ConvertTo-Json -Depth 4 | ||
| Set-Content -Path $ManifestPath -Value $json -Encoding utf8NoBOM | ||
| Write-Host "Manifest written to $ManifestPath" | ||
| # Post-write sanitization check — reject if the file contains tokens, | ||
| # private checkout paths, or environment secret names. | ||
| $content = Get-Content $ManifestPath -Raw | ||
| $suspiciousPatterns = @( | ||
| 'ghp_' # GitHub PAT prefix | ||
| 'gho_' # GitHub OAuth prefix | ||
| 'github_pat_' # Fine-grained PAT prefix | ||
| 'GHCP_CLI_' # Environment secret name fragment | ||
| '\\source\\cli' # Private CLI absolute path (backslash) | ||
| '/source/cli' # Private CLI absolute path (forward slash) | ||
| ) | ||
| foreach ($pattern in $suspiciousPatterns) { | ||
| if ($content -match [regex]::Escape($pattern)) { | ||
| Remove-Item $ManifestPath -Force -ErrorAction SilentlyContinue | ||
| throw "Manifest contains suspicious content matching '$pattern'. File removed." | ||
| } | ||
| } |
| @@ -0,0 +1,366 @@ | |||
| #Requires -Version 7.0 | |||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📖 Description
Adds a manual-only
copilot-cli-buildvalidation plan that runs on1es-mxc-windows-prerelease-t1-x64and:microsoft/mxc@mainand privategithub/copilot-agent-runtime@main;copilotenvironment'sGHCP_CLI_SOURCE_READsecret only for private source checkout;mxc-sdk;copilot-mxc-testcommand;This first lane proves private checkout, combined compilation, staging, and provenance. It intentionally does not authenticate to Copilot or run sandbox capability scenarios yet.
🔗 References
🔍 Validation
pwsh -NoProfile -File scripts/ci/test-copilot-cli-mxc-build.ps1— 14 contract tests pass.git diff --checkpasses.✅ Checklist
Cargo.lock, thedependency-feed-checkcheck passes (not applicable;Cargo.lockis unchanged)📋 Issue Type
GitHub Actions runs the PR validation build automatically. The ADO pipeline
(
MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHubActions build; it runs on merge to
main, and Microsoft reviewers with write access can trigger iton a PR with
/azp run. See docs/pull-requests.md.If the
dependency-feed-checkcheck fails on a new dependency, the crate must be added tothe feed before the PR can pass. See docs/pull-requests.md
for the steps.
Microsoft Reviewers: Open in CodeFlow